Cookie Policy

Website: www.attop.co.uk | Contact: info@attop.co.uk

Registered office: 65 Broadway, London, E15 4BQ, United Kingdom | Company number: 09943794

Important publication note: This policy must be matched to a live cookie and tracking audit before publication. Names, providers, durations and transfers cannot responsibly be asserted without examining the deployed website. Section 11 identifies the inventory to complete. The registered office should also be checked against the live Companies House entry.

1. Introduction

Attop Group Limited (“Attop Group”, “we”, “us” and “our”) respects your privacy and is committed to explaining clearly how cookies and similar technologies are used on www.attop.co.uk (“our website”). This Cookie Policy describes what these technologies are, why they may be used, when your consent is required, how you can manage your choices, and how the information collected relates to our wider Privacy Notice. It applies to visitors browsing our recruitment and staffing website, including prospective employers, job seekers, candidates, temporary workers, contractors and other business contacts. This policy should be read alongside our Privacy Notice, which explains how we process personal data more generally.

2. Who We Are and How to Contact Us

The operator of this website is ATTOP GROUP LTD, company number 09943794, registered office 65 Broadway, London, E15 4BQ, United Kingdom. Website: www.attop.co.uk. For questions about cookies, privacy preferences or personal data, email info@attop.co.uk and include “Cookie Enquiry” in the subject line. Where we determine the purposes and means of processing personal information obtained through website technologies, we act as a data controller. Other providers may act as our processors or as independent controllers depending on their services and actual arrangements.

3. Applicable UK Law and Regulatory Framework

We seek to comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), as amended, the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, as amended, relevant provisions of the Data (Use and Access) Act 2025, and applicable Information Commissioner’s Office (“ICO”) guidance. PECR governs storing information on, or accessing information from, a visitor’s device, including cookies and equivalent tracking technologies. Where those activities also involve personal data, UK GDPR requirements apply in addition. An exception to the PECR consent requirement does not automatically remove other obligations such as transparency, security, purpose limitation and an appropriate UK GDPR lawful basis.

4. What Cookies Are

Cookies are small text files that a website or service can place on your computer, phone, tablet or other device through a browser. They may help a website recognise a browser, remember preferences, maintain a secure session, measure usage or support advertising. Cookies may be “session” cookies, which ordinarily expire when the browsing session ends, or “persistent” cookies, which remain until their stated expiry or deletion. Cookies may be set by Attop Group (“first-party”) or by a separate organisation whose service is used on our website (“third-party”). The name or origin of a cookie alone does not determine whether consent is required; its purpose and the relevant legal conditions matter.

5. Similar Technologies

References to “cookies” in this policy also include, where relevant, pixels, tags, scripts, local storage, software development kit identifiers, device identifiers, tracking URLs, embedded media technologies and other mechanisms that store or access information on a device. These technologies may operate without creating a traditional browser cookie. We assess them according to their actual operation and purpose. Technologies used by embedded maps, videos, social media features, chat tools, advertising tags or applicant-tracking integrations may require separate assessment before being enabled.

6. Categories of Cookies and Their Purposes

Strictly necessary technologies: These are used only where genuinely required to provide a service requested by a visitor, support essential security or carry out another use covered by a statutory exception. Examples can include session management, secure form submission, fraud prevention and recording privacy preferences. A technology is not automatically “necessary” merely because it benefits the business.

Functional or preference technologies: These may remember optional settings, language choices or other preferences. Whether consent is needed depends on their precise purpose and whether a valid exception applies.

Analytics and performance technologies: These may measure visits, navigation, site errors, referral sources or interactions so that we can understand and improve the website. Some narrowly defined statistical uses may qualify for a legal exception if every condition is satisfied, including relevant information and objection rights; other analytics require consent.

Advertising and marketing technologies: These may measure campaigns, attribute conversions, create audiences, support remarketing or track activity across services. Where they store or access device information and no exception applies, we request valid consent before using them.

Third-party embedded content: Embedded videos, maps, recruitment widgets, social media features and similar services may use cookies or equivalent technologies. We assess them individually and apply consent controls where required.

7. How Consent Works

Where consent is legally required, we will seek it before the relevant non-exempt technology is set or accessed. Our consent interface should provide clear information and an affirmative choice. It should offer “Accept All”, “Reject All” and “Customise Settings” with equally accessible choices, without pre-ticked optional categories or misleading design. Continuing to browse, scrolling, silence or inactivity does not itself constitute valid consent. Consent must be freely given, specific, informed and unambiguous. Refusing optional cookies should not prevent ordinary access to our website, although particular optional features may not function. We will not treat consent to one purpose as consent to an unrelated purpose.

8. Changing or Withdrawing Your Choices

You may change or withdraw consent at any time using the “Cookie Settings” link available in the website footer or other persistent privacy control. Withdrawing consent should be as easy as giving it. When you withdraw consent, we will stop the relevant future non-exempt storage or access, subject to technical limitations and any other lawful processing already undertaken. Withdrawal does not retrospectively invalidate processing carried out while valid consent existed. If you delete the preference cookie or use a different browser or device, the website may ask for your preferences again.

9. Cookies That May Not Require Consent

PECR includes limited exceptions, including certain uses strictly necessary to provide an information society service requested by the user and uses for the sole purpose of carrying out transmission of a communication. UK law also provides specified additional exceptions, subject to their conditions, including certain statistical and appearance-related uses. We will assess each proposed use against the current legal wording and ICO guidance rather than assuming that all analytics, preferences or security technologies are exempt. Where a relevant exception requires information or an opportunity to object, we will provide it. We will document the basis on which an exception is used.

10. Third-Party Services and Advertising

Our website may use services supplied by external providers for analytics, advertising, spam protection, recruitment forms, hosting, security or embedded content. Depending on the tools actually deployed, these could include services associated with Google, Meta, LinkedIn, Nextdoor or other providers. Mentioning a provider here does not mean that its technology is currently installed. We will not present an illustrative provider as an active provider until verified. Where third parties use information for their own purposes, their privacy notices may also apply. We will assess contractual roles, consent requirements, data sharing, international transfers and security before implementing new tools. We will seek to prevent candidate CVs, identification documents, application free-text fields and other sensitive recruitment information from being sent through advertising pixels or analytics events.

11. Live Cookie and Tracking Inventory

For transparency, the website must display an accurate, maintained inventory of the technologies actually used. The developer or responsible website administrator must complete the following information after testing the live website in a fresh browser before consent, after rejection, after acceptance and after withdrawal: exact cookie or storage identifier; provider/domain; first- or third-party status; purpose; category; session or persistent status; expiry or retention period; whether consent is required; and relevant third-party privacy link.

No verified live cookie scan has been supplied for this draft. The following table is a publication checklist, not a representation that the listed technologies exist. It must be replaced or supplemented with the actual findings before this policy is published.

The completed table should list each active technology individually, not merely a broad category.

12. Consent Records and Preference Retention

Where we rely on consent, we will maintain appropriate records to demonstrate how and when a choice was obtained, what information was presented, the categories selected and relevant changes or withdrawals, insofar as necessary and proportionate. Consent records should not themselves become a vehicle for unnecessary tracking. We will review how long a preference or consent record remains valid and when renewed consent is appropriate, particularly following material changes in purposes, providers or technologies. We will retain records only as long as necessary for compliance and legitimate evidential purposes.

13. Browser and Device Controls

Most browsers allow you to inspect, block or delete cookies through their privacy or site settings. Some browsers also offer private browsing modes, tracking prevention or controls for third-party cookies. The exact steps vary by browser and device; consult the browser provider’s help information. Blocking all cookies may interfere with essential website functions, including secure forms or saved preferences. Browser controls are additional to, and do not replace, our obligation to obtain valid consent where required. Some similar technologies may require separate browser or device controls.

14. Personal Data Collected Through Website Technologies

Depending on the technologies actually enabled, information may include an IP address, approximate location inferred from technical data, device and browser details, referral information, page visits, click or interaction events, identifiers and preference choices. Such information can constitute personal data, especially when linked with other information. We will process it for specified purposes, minimise collection, apply an appropriate UK GDPR lawful basis, explain relevant sharing and protect it with appropriate security measures. For more information about rights and wider data processing, consult our Privacy Notice.

15. Lawful Bases Under UK GDPR

Consent under PECR for storing or accessing information on a device is distinct from identifying a lawful basis under UK GDPR for any resulting personal data processing. Depending on the purpose, we may rely on consent, legitimate interests or another applicable lawful basis, subject to the conditions of UK GDPR. For optional advertising and cross-site tracking, consent will generally be central to the assessment. For security and strictly necessary website operation, legitimate interests or another appropriate basis may apply to associated personal data. We will assess actual processing activities individually and will not use a generic statement to justify incompatible purposes.

16. Data Sharing and International Transfers

Information obtained through website technologies may be processed by hosting providers, consent-management providers, security vendors, analytics suppliers or advertising services where these are actually engaged. We will identify relevant recipients and roles in our records and privacy information. Some providers may process data outside the UK. Where a restricted international transfer occurs, we will use an applicable UK adequacy regulation, appropriate contractual safeguard or other lawful transfer mechanism, together with any required risk assessment. We will not claim that all processing occurs in the UK unless this has been verified.

17. Retention and Deletion

Different cookies and technologies may have different lifetimes. Session cookies ordinarily expire at the end of a session; persistent cookies expire at a specified time or when deleted. The exact duration of each active technology will be shown in the verified inventory. Personal information derived from cookies may be retained for a different period according to the relevant purpose, lawful basis and documented retention schedule. We will review and remove unnecessary technologies and records. We will not describe an invented universal retention period as if it applies to every provider.

18. Security

We seek to use appropriate technical and organisational measures to protect information collected through the website, including secure connections, access controls, proportionate logging, vendor assessment and maintenance of website components. We will limit access to cookie-derived personal information to authorised persons with a legitimate need. No website or transmission method can be guaranteed completely secure, but we will assess risks and take proportionate steps to reduce them.

19. Recruitment Forms and Applicant Information

Attop Group operates recruitment and staffing services across Legal; Engineering & Manufacturing; IT & Technology; Security; Joinery & Woodworking; Finance & Professional Services; Renewable Energy; Warehousing & Logistics; Skilled Trades; Sales & Commercial; Driving & Transport; and Hospitality. Cookies may be used to support secure submission of enquiries, candidate registrations, applications or employer staffing requests. Any optional analytics or advertising technology used around these forms must be assessed carefully to avoid exposing candidate identities, CV content, right-to-work documentation, contact details or other confidential information. The handling of application data itself is explained in our Privacy Notice and, where applicable, candidate-specific privacy information.

20. Children’s Information

Our website principally serves employers and people seeking employment or staffing services. We do not use cookies intentionally to profile children for advertising. Where individuals under 18 use our services, we will consider applicable data protection safeguards and the circumstances of the processing. We will not assume that the ordinary recruitment context removes any obligations that apply to children’s personal data.

21. Your Rights and Complaints

Where cookie-related information is personal data, you may have rights of access, rectification, erasure, restriction, objection and portability, subject to legal conditions and exemptions. Where we rely on consent, you may withdraw it. You have the right to complain to the Information Commissioner’s Office (ICO), whose website is www.ico.org.uk and telephone number is 0303 123 1113. We encourage you to contact us at info@attop.co.uk first so we can investigate your concern. Requests will be handled within applicable statutory timescales.

22. Changes to This Cookie Policy

We may update this Cookie Policy to reflect changes to our website, third-party services, technologies, law or regulatory guidance. The effective date at the top will be updated when the policy changes. Where a change introduces a new consent-requiring purpose or materially changes an existing one, we will seek fresh consent as required before enabling the relevant technology. We will review this policy alongside the live cookie inventory and our wider Privacy Notice.

23. Contact Details

ATTOP GROUP LTD
Company registration number: 09943794
Registered office: 65 Broadway, London, E15 4BQ, United Kingdom
Website: www.attop.co.uk
Email: info@attop.co.uk

Please use “Cookie Enquiry” or “Data Protection Request” in the email subject line as appropriate. We aim to respond to concerns clearly and in accordance with applicable legal requirements.

24. Implementation and Publication Verification

This final section is an explicit transparency safeguard pending technical verification. Before this policy is published as a live legal notice, Attop Group and its website developer should: (a) audit cookies and equivalent storage/access technologies in the live site and all embedded forms; (b) complete the actual inventory below; (c) test Accept All, Reject All, Customise Settings and withdrawal on desktop and mobile; (d) confirm that non-exempt technologies do not run before valid consent; (e) confirm any reliance on statutory exceptions and related objection controls; (f) check the actual provider privacy links and international transfers; (g) ensure cookie notices match the Privacy Notice; (h) verify the company’s registered office against Companies House; and (i) remove this verification section or adapt it into an internal implementation record once the facts are confirmed. A document alone cannot establish that the website is compliant.